1. Field
The present disclosure relates generally to computer software and more particularly to network security.
2. Reference to an Appendix
The present disclosure includes an Appendix of pseudo source code related to tests of events and
3. Background
Security Event Managers (SEMs) focus primarily on the tools, technologies and services that are needed by IT security operations to manage security devices and the security of IT infrastructure, applications and transactions. The value proposition for such technology is the correlation of security data from multiple devices and systems to enable better security assessment and support appropriate remedial action. The motivation behind this technology grew out of the failure of intrusion detection systems (IDSs) to separate real threats from the background noise of ineffective probes, false alarms and normal system changes.
At one time IT security staff responsible for security operations faced a significant challenge when it came to protecting the security infrastructure of an organization. Faced with excess instrumentation for networks, servers and security devices that produced a flood of data and false alarms, security personnel had to sort through the data to determine if a security event was taking place, substantiate the criticality of the event and finally initiate an appropriate response.
It was in this environment that IT security management market emerged to meet the need to improve the efficiency of intrusion detection systems, consolidate information about enterprises' general security postures and support enterprises' efforts to consolidate security operations. In addition, companies are turning to centralized security event management tools to help them make sense of crucial security information.
There remains a need in this area for improved incident management systems and methods that identify useful information while discarding unwanted or unneeded data.